{"metadata":{"name":"KEVWire","version":"6.0.0","description":"Source-reviewed editorial records covering exploited vulnerabilities, notable disclosed breaches, and AI security research.","coverageNote":"Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends.","stacks":["Microsoft Windows","Oracle","Google Chrome","Microsoft Office","WordPress","Adobe","Juniper Networks","Linux kernel","Cisco","Python packages (PyPI)","JavaScript packages (npm)","Microsoft","Android","IBM","Apple iOS and iPadOS",".NET","Python","Progress (MOVEit, Telerik, WS_FTP)","Microsoft SharePoint","Ivanti","F5 BIG-IP","Fortinet","Apple macOS","FreeRDP","Node.js","Java","Apple","D-Link","VMware","Mozilla Firefox and Thunderbird","Arubanetworks","Palo Alto Networks","Citrix NetScaler","Microsoft Exchange","Adobe Commerce and Magento","MySQL and MariaDB","Nginx","SAP","Zimbra","Safari and WebKit","Adobe Acrobat and Reader","Docker and containers","Microsoft Azure","Go modules","Kubernetes","SonicWall","vLLM","Apache","Visual Studio","Craft CMS","Hyper-V","Microsoft SQL Server","QNAP","GitLab","pfSense","Roundcube","AI coding agents","Atlassian","FreeBSD","Samsung mobile","Apache Tomcat","Zyxel","Java packages (Maven)","MCP servers and SDKs","DrayTek","Next.js","Red Hat Enterprise Linux","Dell","Qualcomm chipsets","SolarWinds","Trend Micro","PHP","Eclipse","Netgear","Apache Struts","Arm","Electron","JetBrains TeamCity","LangChain and Langflow","Rust crates","Zoho ManageEngine","Apache HTTP Server","Drupal","OpenSSH","PHP packages (Composer)","PostgreSQL","Redhat","TP-Link","Arista","Getgrav","GNU","LiteLLM","MikroTik","Mitel","Mongodb","Sophos",".NET packages (NuGet)","7-Zip and WinRAR","Grafana","Jenkins","Microsoft Edge","Netty","Openimageio","Pgadmin","Ubiquiti","BeyondTrust","Check Point","ConnectWise","Exim","Fleetdm","N-able","PaperCut","Plex Media Server","Redis","Roocode","WatchGuard","Accellion","Axis","Dani-garcia","Elasticsearch","Fortra","GIGABYTE","Gladinet","Google","JFrog","Joomla","Kentico","Mediawiki","Nagios","Openstack","Pupnp Project","Sangoma","SimpleHelp","Sitecore","Veeam","Apache ActiveMQ","ASUS","CrushFTP","Dassault Systèmes","DotNetNuke (DNN)","Frappe","ImageMagick","Iocoder","Kaseya","Laravel","Meta Platforms","OpenSSL","OSGeo","Paloaltonetworks","Praison","Qlik","Realtek","Ruby on Rails","SaltStack","Siemens","SmarterTools","Sparxsystems","SysAid","Tabby","TeleMessage","Tenda","TrueConf","Veritas","Collabora and Nextcloud","Commvault","HPE Aruba","Ollama","Log4j","Ray","Ruby gems","Schneider Electric"],"technologies":[{"label":"Microsoft Windows","count":644,"curated":true},{"label":"Oracle","count":497,"curated":true},{"label":"Google Chrome","count":460,"curated":true},{"label":"Microsoft Office","count":256,"curated":true},{"label":"WordPress","count":188,"curated":true},{"label":"Adobe","count":159,"curated":true},{"label":"Juniper Networks","count":151,"curated":true},{"label":"Linux kernel","count":139,"curated":true},{"label":"Cisco","count":130,"curated":true},{"label":"Python packages (PyPI)","count":129,"curated":true},{"label":"JavaScript packages (npm)","count":125,"curated":true},{"label":"Microsoft","count":96,"curated":false},{"label":"Android","count":91,"curated":true},{"label":"IBM","count":80,"curated":true},{"label":"Apple iOS and iPadOS","count":77,"curated":true},{"label":".NET","count":59,"curated":true},{"label":"Python","count":55,"curated":true},{"label":"Progress (MOVEit, Telerik, WS_FTP)","count":54,"curated":true},{"label":"Microsoft SharePoint","count":47,"curated":true},{"label":"Ivanti","count":46,"curated":true},{"label":"F5 BIG-IP","count":44,"curated":true},{"label":"Fortinet","count":43,"curated":true},{"label":"Apple macOS","count":41,"curated":true},{"label":"FreeRDP","count":41,"curated":true},{"label":"Node.js","count":41,"curated":true},{"label":"Java","count":40,"curated":true},{"label":"Apple","count":39,"curated":false},{"label":"D-Link","count":38,"curated":true},{"label":"VMware","count":36,"curated":true},{"label":"Mozilla Firefox and Thunderbird","count":31,"curated":true},{"label":"Arubanetworks","count":29,"curated":false},{"label":"Palo Alto Networks","count":29,"curated":true},{"label":"Citrix NetScaler","count":28,"curated":true},{"label":"Microsoft Exchange","count":27,"curated":true},{"label":"Adobe Commerce and Magento","count":26,"curated":true},{"label":"MySQL and MariaDB","count":26,"curated":true},{"label":"Nginx","count":26,"curated":true},{"label":"SAP","count":26,"curated":true},{"label":"Zimbra","count":26,"curated":true},{"label":"Safari and WebKit","count":25,"curated":true},{"label":"Adobe Acrobat and Reader","count":24,"curated":true},{"label":"Docker and containers","count":24,"curated":true},{"label":"Microsoft Azure","count":24,"curated":true},{"label":"Go modules","count":21,"curated":true},{"label":"Kubernetes","count":21,"curated":true},{"label":"SonicWall","count":21,"curated":true},{"label":"vLLM","count":20,"curated":true},{"label":"Apache","count":19,"curated":false},{"label":"Visual Studio","count":19,"curated":true},{"label":"Craft CMS","count":18,"curated":true},{"label":"Hyper-V","count":18,"curated":true},{"label":"Microsoft SQL Server","count":18,"curated":true},{"label":"QNAP","count":18,"curated":true},{"label":"GitLab","count":17,"curated":true},{"label":"pfSense","count":17,"curated":true},{"label":"Roundcube","count":17,"curated":true},{"label":"AI coding agents","count":16,"curated":true},{"label":"Atlassian","count":16,"curated":true},{"label":"FreeBSD","count":16,"curated":true},{"label":"Samsung mobile","count":16,"curated":true},{"label":"Apache Tomcat","count":15,"curated":true},{"label":"Zyxel","count":15,"curated":true},{"label":"Java packages (Maven)","count":14,"curated":true},{"label":"MCP servers and SDKs","count":14,"curated":true},{"label":"DrayTek","count":13,"curated":true},{"label":"Next.js","count":13,"curated":true},{"label":"Red Hat Enterprise Linux","count":13,"curated":true},{"label":"Dell","count":12,"curated":true},{"label":"Qualcomm chipsets","count":12,"curated":true},{"label":"SolarWinds","count":12,"curated":true},{"label":"Trend Micro","count":12,"curated":true},{"label":"PHP","count":11,"curated":true},{"label":"Eclipse","count":10,"curated":false},{"label":"Netgear","count":10,"curated":true},{"label":"Apache Struts","count":9,"curated":true},{"label":"Arm","count":9,"curated":false},{"label":"Electron","count":9,"curated":true},{"label":"JetBrains TeamCity","count":9,"curated":true},{"label":"LangChain and Langflow","count":9,"curated":true},{"label":"Rust crates","count":9,"curated":true},{"label":"Zoho ManageEngine","count":9,"curated":true},{"label":"Apache HTTP Server","count":8,"curated":true},{"label":"Drupal","count":8,"curated":true},{"label":"OpenSSH","count":8,"curated":true},{"label":"PHP packages (Composer)","count":8,"curated":true},{"label":"PostgreSQL","count":8,"curated":true},{"label":"Redhat","count":8,"curated":false},{"label":"TP-Link","count":8,"curated":true},{"label":"Arista","count":7,"curated":true},{"label":"Getgrav","count":7,"curated":false},{"label":"GNU","count":7,"curated":false},{"label":"LiteLLM","count":7,"curated":true},{"label":"MikroTik","count":7,"curated":true},{"label":"Mitel","count":7,"curated":true},{"label":"Mongodb","count":7,"curated":false},{"label":"Sophos","count":7,"curated":true},{"label":".NET packages (NuGet)","count":6,"curated":true},{"label":"7-Zip and WinRAR","count":6,"curated":true},{"label":"Grafana","count":6,"curated":true},{"label":"Jenkins","count":6,"curated":true},{"label":"Microsoft Edge","count":6,"curated":true},{"label":"Netty","count":6,"curated":false},{"label":"Openimageio","count":6,"curated":false},{"label":"Pgadmin","count":6,"curated":false},{"label":"Ubiquiti","count":6,"curated":true},{"label":"BeyondTrust","count":5,"curated":true},{"label":"Check Point","count":5,"curated":true},{"label":"ConnectWise","count":5,"curated":true},{"label":"Exim","count":5,"curated":true},{"label":"Fleetdm","count":5,"curated":false},{"label":"N-able","count":5,"curated":true},{"label":"PaperCut","count":5,"curated":true},{"label":"Plex Media Server","count":5,"curated":true},{"label":"Redis","count":5,"curated":true},{"label":"Roocode","count":5,"curated":false},{"label":"WatchGuard","count":5,"curated":true},{"label":"Accellion","count":4,"curated":false},{"label":"Axis","count":4,"curated":false},{"label":"Dani-garcia","count":4,"curated":false},{"label":"Elasticsearch","count":4,"curated":true},{"label":"Fortra","count":4,"curated":false},{"label":"GIGABYTE","count":4,"curated":false},{"label":"Gladinet","count":4,"curated":false},{"label":"Google","count":4,"curated":false},{"label":"JFrog","count":4,"curated":false},{"label":"Joomla","count":4,"curated":true},{"label":"Kentico","count":4,"curated":false},{"label":"Mediawiki","count":4,"curated":false},{"label":"Nagios","count":4,"curated":false},{"label":"Openstack","count":4,"curated":false},{"label":"Pupnp Project","count":4,"curated":false},{"label":"Sangoma","count":4,"curated":false},{"label":"SimpleHelp","count":4,"curated":false},{"label":"Sitecore","count":4,"curated":false},{"label":"Veeam","count":4,"curated":true},{"label":"Apache ActiveMQ","count":3,"curated":true},{"label":"ASUS","count":3,"curated":false},{"label":"CrushFTP","count":3,"curated":false},{"label":"Dassault Systèmes","count":3,"curated":false},{"label":"DotNetNuke (DNN)","count":3,"curated":false},{"label":"Frappe","count":3,"curated":false},{"label":"ImageMagick","count":3,"curated":false},{"label":"Iocoder","count":3,"curated":false},{"label":"Kaseya","count":3,"curated":false},{"label":"Laravel","count":3,"curated":false},{"label":"Meta Platforms","count":3,"curated":false},{"label":"OpenSSL","count":3,"curated":true},{"label":"OSGeo","count":3,"curated":false},{"label":"Paloaltonetworks","count":3,"curated":false},{"label":"Praison","count":3,"curated":false},{"label":"Qlik","count":3,"curated":false},{"label":"Realtek","count":3,"curated":false},{"label":"Ruby on Rails","count":3,"curated":true},{"label":"SaltStack","count":3,"curated":false},{"label":"Siemens","count":3,"curated":true},{"label":"SmarterTools","count":3,"curated":false},{"label":"Sparxsystems","count":3,"curated":false},{"label":"SysAid","count":3,"curated":false},{"label":"Tabby","count":3,"curated":false},{"label":"TeleMessage","count":3,"curated":false},{"label":"Tenda","count":3,"curated":false},{"label":"TrueConf","count":3,"curated":false},{"label":"Veritas","count":3,"curated":false},{"label":"Collabora and Nextcloud","count":2,"curated":true},{"label":"Commvault","count":2,"curated":true},{"label":"HPE Aruba","count":2,"curated":true},{"label":"Ollama","count":2,"curated":true},{"label":"Log4j","count":1,"curated":true},{"label":"Ray","count":1,"curated":true},{"label":"Ruby gems","count":1,"curated":true},{"label":"Schneider Electric","count":1,"curated":true}]},"selection":{"total":8058,"knownExploitedLast30Days":35,"criticalLast30Days":780,"federalDueWithin7Days":2},"searchNote":null,"items":[{"id":"CVE-2026-109618","cveId":"CVE-2026-109618","aliases":["PHP2Shell","php2shell"],"kind":"vulnerability","title":"PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","summary":"The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.\n\n Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.\n\n Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.\n\n Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. \n\n The disruption put the National Security Agency and Europe's cybersecurity agency on alert.\n\n State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.\n\n What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery \"one of the most impactful security issues in recent memory.\"\n\n \"To our knowledge, frontier AI found these vulnerabilities before attackers did,\" OpenAI said.\n\n The cybersecurity firm Wiz wrote in a blog post : \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n\n Read more below. \n\n What is PHP?\n\n You've probably never heard of PHP, even though you've interacted with it for decades.\n\n PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.\n\n It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.\n\n It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. \n\n How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.\n\n What was the PHP vulnera","detail":"The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.\n\n Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.\n\n Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.\n\n Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. \n\n The disruption put the National Security Agency and Europe's cybersecurity agency on alert.\n\n State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.\n\n What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery \"one of the most impactful security issues in recent memory.\"\n\n \"To our knowledge, frontier AI found these vulnerabilities before attackers did,\" OpenAI said.\n\n The cybersecurity firm Wiz wrote in a blog post : \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n\n Read more below. \n\n What is PHP?\n\n You've probably never heard of PHP, even though you've interacted with it for decades.\n\n PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.\n\n It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.\n\n It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. \n\n How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.\n\n What was the PHP vulnerability, exactly?\n\n AI researchers discovered two critical vulnerabilities in PHP that could allow an attacker to take control of a website's server without having legitimate access to it.\n\n Hackers could exploit the flaws, dubbed \" php2shell \" by cybersecurity firms, to steal information from those websites.\n\n Between the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz.\n\n Why cybersecurity incidents are a big deal\n\n Thought bubble via Axios' Bradley Olson : The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug.\n\n But the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins at public companies and more.\n\n A major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain.\n\n Cyber pros are calling the series of attacks \"Black October\" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm.\n\n While defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem.\n\n The bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic.\n\n As with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-22T18:01:31.000Z","updatedAt":"2026-10-26T10:10:00.140Z","regions":["Japan","Global"],"vendor":"php","product":"php","stacks":["PHP","php"],"knownExploited":true,"zeroDay":null,"kev":null,"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618","asOf":"2026-10-26T10:10:00.140Z"},"epss":{"probability":0.99981,"percentile":0.99981,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109618&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency","url":"https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites","type":"reporting","publishedAt":"2026-10-22T18:01:31.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"Axios syndication feed","url":"https://api.axios.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"NVD CVE-2026-109618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618","type":"primary","publishedAt":"2026-10-21T14:17:09.357Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (updated)","url":"https://www.jpcert.or.jp/at/2026/at260033.html","type":"primary","publishedAt":"2026-10-26T07:25:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware","url":"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html","type":"reporting","publishedAt":"2026-10-23T07:40:45.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity","url":"https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html","type":"reporting","publishedAt":"2026-10-25T17:19:46.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed","url":"https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html","type":"reporting","publishedAt":"2026-10-22T06:34:10.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge","url":"https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html","type":"reporting","publishedAt":"2026-10-21T14:00:00.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't","url":"https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html","type":"reporting","publishedAt":"2026-10-21T10:36:53.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","url":"https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html","type":"reporting","publishedAt":"2026-10-21T09:05:17.000Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities","url":"https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/","type":"reporting","publishedAt":"2026-10-26T14:52:14.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"SecurityWeek syndication feed","url":"https://www.securityweek.com/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells","url":"https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/","type":"reporting","publishedAt":"2026-10-26T13:30:10.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge","url":"https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/","type":"reporting","publishedAt":"2026-10-23T12:45:52.000Z","checkedAt":"2026-10-26T14:50:56.006Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits","url":"https://therecord.media/php-php2shell-exploitation-attempts-pocs","type":"reporting","publishedAt":"2026-10-23T04:00:00.000Z","checkedAt":"2026-10-26T14:15:55.780Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Record (Recorded Future News) syndication feed","url":"https://therecord.media/feed","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T14:15:55.780Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched","url":"https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/","type":"reporting","publishedAt":"2026-10-22T02:24:17.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"WIRED Security syndication feed","url":"https://www.wired.com/feed/category/security/latest/rss","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109618&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-109618, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null},"related":["CVE-2026-109619","CVE-2026-115560"]},{"id":"CVE-2026-0257","cveId":"CVE-2026-0257","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","summary":"Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched...\n Source","detail":"Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched...\n Source\n\nSyndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.","action":"Check the vendor advisory linked from the article for affected versions and fixes.","publishedAt":"2026-10-20T16:08:24.000Z","updatedAt":"2026-10-26T14:10:00.130Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","PAN-OS","pan-os"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-05-29","dueAt":"2026-06-01","action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomwareUse":"Known","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0257","asOf":"2026-10-26T14:10:00.130Z"},"epss":{"probability":0.95012,"percentile":0.99861,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-0257&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"DataBreaches.net: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA","url":"https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/","type":"reporting","publishedAt":"2026-10-20T16:08:24.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"The article reports this vulnerability. It is reporting, not independently primary-confirmed or locally reviewed."},{"name":"DataBreaches.net syndication feed","url":"https://databreaches.net/feed/","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"NVD CVE-2026-0257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0257","type":"primary","publishedAt":"2026-05-13T19:17:01.040Z","checkedAt":"2026-10-26T15:20:55.429Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0257","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:45:57.368Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-0257","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-05-29","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-0257 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-0257&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-0257, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-106931","cveId":"CVE-2026-106931","aliases":[],"kind":"vulnerability","title":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","summary":"EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":"2026-10-21T15:42:24.590Z","regions":["Global","Japan"],"vendor":"EG Secure Solutions","product":"SiteGuard Server Edition","stacks":["EG Secure Solutions","SiteGuard Server Edition","siteguard"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-10-23","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106931","asOf":"2026-10-21T15:42:24.590Z"},"epss":{"probability":0.02528,"percentile":0.8478,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-106931&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-106931","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-106931 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"JPCERT/CC Japan Advisories: Security alert: OS command injection vulnerability in SiteGuard Server Edition (CVE-2026-106931) (published)","url":"https://www.jpcert.or.jp/at/2026/at260032.html","type":"primary","publishedAt":"2026-10-14T05:18:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"NVD CVE-2026-106931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106931","type":"primary","publishedAt":"2026-10-14T05:16:42.633Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.eg-secure.co.jp/siteguard/news/alert-202610-1","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106931&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-106931, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-110447","cveId":"CVE-2026-110447","aliases":[],"kind":"vulnerability","title":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","summary":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.","detail":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T03:17:20.683Z","updatedAt":"2026-10-26T16:48:12.087Z","regions":["Global"],"vendor":"collabora","product":"online","stacks":["Collabora and Nextcloud","Collabora","Collabora Online – Built-in CODE Server","online"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-23","dueAt":"2026-10-26","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447","asOf":"2026-10-26T16:48:12.087Z"},"epss":{"probability":0.12328,"percentile":0.96163,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110447&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447","type":"primary","publishedAt":"2026-10-14T03:17:20.683Z","checkedAt":"2026-10-26T17:50:56.936Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:50:56.936Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T17:20:56.094Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:50:55.493Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-110447","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-110447 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud","url":"https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html","type":"reporting","publishedAt":"2026-10-24T06:25:57.000Z","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The article reports exploitation in the wild (attempted or successful). It is reporting, not independently primary-confirmed."},{"name":"The Hacker News syndication feed","url":"https://feeds.feedburner.com/TheHackersNews","type":"reporting","publishedAt":null,"checkedAt":"2026-10-26T18:50:55.505Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110447&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110447, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-105134","cveId":"CVE-2026-105134","aliases":[],"kind":"vulnerability","title":"Ahsay AhsayCBS Command Injection Vulnerability","summary":"A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.","detail":"A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-04T07:16:33.480Z","updatedAt":"2026-10-26T18:06:57.930Z","regions":["Global"],"vendor":"ahsay","product":"cloud backup suite","stacks":["Ahsay","AhsayCBS","cloud backup suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-14","dueAt":"2026-10-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-105134","asOf":"2026-10-04T05:30:12.882Z"},"epss":{"probability":0.86266,"percentile":0.99731,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105134&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105134","type":"primary","publishedAt":"2026-10-04T07:16:33.480Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-105134","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-105134 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105134&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105134, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA VulDB","url":"https://cveawg.mitre.org/api/cve/CVE-2026-105134","type":"primary","publishedAt":"2026-10-04T05:30:12.882Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-105134 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null}},{"id":"CVE-2026-105133","cveId":"CVE-2026-105133","aliases":[],"kind":"vulnerability","title":"Ahsay AhsayCBS Improper Authentication Vulnerability","summary":"A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.","detail":"A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-04T07:16:33.087Z","updatedAt":"2026-10-26T18:07:09.000Z","regions":["Global"],"vendor":"ahsay","product":"cloud backup suite","stacks":["Ahsay","AhsayCBS","cloud backup suite"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-14","dueAt":"2026-10-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-105133","asOf":"2026-10-04T05:15:14.561Z"},"epss":{"probability":0.79236,"percentile":0.99595,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-105133&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-105133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105133","type":"primary","publishedAt":"2026-10-04T07:16:33.087Z","checkedAt":"2026-10-26T18:20:57.477Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:20:57.477Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T16:20:55.068Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:50:56.370Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T15:20:55.429Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-105133","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-105133 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105133&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-105133, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA VulDB","url":"https://cveawg.mitre.org/api/cve/CVE-2026-105133","type":"primary","publishedAt":"2026-10-04T05:15:14.561Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-105133 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null}},{"id":"CVE-2026-114625","cveId":"CVE-2026-114625","aliases":[],"kind":"vulnerability","title":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","summary":"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nOn an affected system, any authenticated user can gain operator privileges and masquerade as a local \"superuser operator\" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.","detail":"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nOn an affected system, any authenticated user can gain operator privileges and masquerade as a local \"superuser operator\" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-22T21:17:16.870Z","updatedAt":"2026-10-26T13:10:00.140Z","regions":["Global"],"vendor":"arista","product":"velocloud orchestrator","stacks":["Arista","VeloCloud Orchestrator","velocloud orchestrator"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-23","dueAt":"2026-10-26","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114625","asOf":"2026-10-26T13:10:00.140Z"},"epss":{"probability":0.01025,"percentile":0.63324,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-114625&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-114625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114625","type":"primary","publishedAt":"2026-10-22T21:17:16.870Z","checkedAt":"2026-10-26T14:10:55.205Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T14:10:55.205Z","supports":"The NVD API page that supplied this CVE record."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-114625","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-23","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-114625 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114625&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-114625, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-102764","cveId":"CVE-2026-102764","aliases":[],"kind":"vulnerability","title":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","summary":"The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.","detail":"The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T21:17:00.117Z","updatedAt":"2026-10-17T04:16:47.117Z","regions":["Global"],"vendor":"beyondtrust","product":"remote support","stacks":["BeyondTrust","Remote Support","remote support"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-16","dueAt":"2026-10-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","asOf":"2026-10-17T04:16:47.117Z"},"epss":{"probability":0.20341,"percentile":0.97462,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-102764&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-102764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","type":"primary","publishedAt":"2026-10-15T21:17:00.117Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://www.beyondtrust.com/blog/entry/bt26-05","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-102764","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-102764 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102764&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-102764, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-110936","cveId":"CVE-2026-110936","aliases":[],"kind":"vulnerability","title":"Siemens Software Center Uncontrolled Search Path Element Vulnerability","summary":"A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.","detail":"A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-15T15:17:30.383Z","updatedAt":"2026-10-21T13:10:11.553Z","regions":["Global"],"vendor":"siemens","product":"software center","stacks":["Siemens","Software Center","software center"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-11-03","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110936","asOf":"2026-10-21T13:10:11.553Z"},"epss":{"probability":0.00967,"percentile":0.61493,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110936&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-110936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110936","type":"primary","publishedAt":"2026-10-15T15:17:30.383Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://cert-portal.siemens.com/productcert/html/ssa-580366.html","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-110936","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-110936 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110936&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-110936, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-0322","cveId":"CVE-2026-0322","aliases":[],"kind":"vulnerability","title":"Palo Alto Networks PAN-OS Code Injection Vulnerability","summary":"A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.\n\n\n\nThe security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\n\n\nCloud NGFW and Prisma® Access are not impacted by this vulnerability.","detail":"A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.\n\n\n\nThe security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\n\n\nCloud NGFW and Prisma® Access are not impacted by this vulnerability.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T18:17:07.743Z","updatedAt":"2026-10-15T13:47:26.713Z","regions":["Global"],"vendor":"paloaltonetworks","product":"pan-os","stacks":["Palo Alto Networks","PAN-OS","pan-os"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-14","dueAt":"2026-10-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0322","asOf":"2026-10-15T13:47:26.713Z"},"epss":{"probability":0.0174,"percentile":0.77559,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-0322&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-0322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0322","type":"primary","publishedAt":"2026-10-14T18:17:07.743Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://security.paloaltonetworks.com/CVE-2026-0322","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-0322","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-0322 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-0322&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-0322, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-76519","cveId":"CVE-2026-76519","aliases":[],"kind":"vulnerability","title":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","summary":"A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.\r\n\r\nThis vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.","detail":"A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.\r\n\r\nThis vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-14T17:19:10.747Z","updatedAt":"2026-10-15T13:47:19.470Z","regions":["Global"],"vendor":"cisco","product":"asyncos","stacks":["Cisco","Secure Email Gateway","asyncos"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-14","dueAt":"2026-10-17","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76519","asOf":"2026-10-15T13:47:19.470Z"},"epss":{"probability":0.02152,"percentile":0.82022,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76519&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-76519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76519","type":"primary","publishedAt":"2026-10-14T17:19:10.747Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-76519","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-14","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-76519 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76519&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-76519, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-104935","cveId":"CVE-2026-104935","aliases":[],"kind":"vulnerability","title":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","summary":"Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.","detail":"Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.\n\nNVD status: Analyzed. Publication in the NVD is not evidence of exploitation.","action":"Check the vendor advisory for affected versions and fixes.","publishedAt":"2026-10-13T16:17:11.640Z","updatedAt":"2026-10-13T19:24:36.243Z","regions":["Global"],"vendor":"ivanti","product":"connect secure","stacks":["Ivanti","Connect Secure","connect secure"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-13","dueAt":"2026-10-16","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104935","asOf":"2026-10-13T19:24:36.243Z"},"epss":{"probability":0.86766,"percentile":0.9974,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-104935&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"NVD CVE-2026-104935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104935","type":"primary","publishedAt":"2026-10-13T16:17:11.640Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"CISA KEV entry CVE-2026-104935","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-104935 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104935&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-104935, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-96951","cveId":"CVE-2026-96951","aliases":[],"kind":"vulnerability","title":"Microsoft Windows Command Injection Vulnerability","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","detail":"CISA added this entry on 2026-10-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-13","updatedAt":"2026-10-16T17:18:00.760Z","regions":["Global"],"vendor":"Microsoft","product":"Windows","stacks":["Microsoft Windows","Microsoft Office","Microsoft","Windows","outlook web"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-13","dueAt":"2026-10-16","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96951","asOf":"2026-10-16T17:18:00.760Z"},"epss":{"probability":0.09813,"percentile":0.95515,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96951&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96951","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-13","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96951 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"NVD CVE-2026-96951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96951","type":"primary","publishedAt":"2026-10-13T19:22:07.760Z","checkedAt":"2026-10-26T13:35:55.142Z","supports":"NVD record: description, CVSS, affected products, and a CISA SSVC assessment reporting active exploitation."},{"name":"Vendor advisory (via NVD references)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The vendor advisory referenced by the CVE record, for affected versions and fixes."},{"name":"NVD CVE API 2.0","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T13:35:55.142Z","supports":"The NVD API page that supplied this CVE record."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96951&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96951, scored 2026-10-25. This is a model estimate, not proof of exposure."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-88771","cveId":"CVE-2026-88771","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler Improper Input Validation Vulnerability","summary":"Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-02T05:15:00.000Z","updatedAt":null,"regions":["Global","Japan"],"vendor":"Citrix","product":"NetScaler","stacks":["Citrix NetScaler","Citrix","NetScaler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-27","dueAt":"2026-09-30","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-88771","asOf":"2026-09-27T16:02:07.001Z"},"epss":{"probability":0.8216,"percentile":0.99652,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88771&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated)","url":"https://www.jpcert.or.jp/at/2026/at260029.html","type":"primary","publishedAt":"2026-10-02T05:15:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"CISA KEV entry CVE-2026-88771","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-88771 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88771&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88771, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA NetScaler","url":"https://cveawg.mitre.org/api/cve/CVE-2026-88771","type":"primary","publishedAt":"2026-09-27T16:02:07.001Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2026-88771 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null}},{"id":"CVE-2026-88772","cveId":"CVE-2026-88772","aliases":[],"kind":"vulnerability","title":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","summary":"Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)","detail":"The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.","action":"Consult the linked JPCERT/CC advisory for affected versions and the recommended action.","publishedAt":"2026-10-02T05:15:00.000Z","updatedAt":null,"regions":["Global","Japan"],"vendor":"Citrix","product":"NetScaler","stacks":["Citrix NetScaler","Citrix","NetScaler"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-09-27","dueAt":"2026-09-30","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-88772","asOf":"2026-09-27T16:09:56.033Z"},"epss":{"probability":0.78162,"percentile":0.99574,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-88772&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated)","url":"https://www.jpcert.or.jp/at/2026/at260029.html","type":"primary","publishedAt":"2026-10-02T05:15:00.000Z","checkedAt":"2026-10-26T18:40:55.462Z","supports":"Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt."},{"name":"JPCERT/CC Japan Advisories syndication feed","url":"https://www.jpcert.or.jp/rss/jpcert.rdf","type":"primary","publishedAt":null,"checkedAt":"2026-10-26T18:40:55.462Z","supports":"The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt."},{"name":"CISA KEV entry CVE-2026-88772","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-09-27","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-88772 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-88772&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-88772, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA NetScaler","url":"https://cveawg.mitre.org/api/cve/CVE-2026-88772","type":"primary","publishedAt":"2026-09-27T16:09:56.033Z","checkedAt":"2026-10-26T14:31:00.258Z","supports":"The published CVE-2026-88772 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:31:00.258Z","reviewedAt":null}},{"id":"CVE-2026-96652","cveId":"CVE-2026-96652","aliases":[],"kind":"vulnerability","title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","summary":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":null,"regions":["Global"],"vendor":"Plex","product":"Media Server","stacks":["Plex Media Server","Plex","Media Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-11-03","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-96652","asOf":"2026-09-23T16:06:15.517Z"},"epss":{"probability":0.01821,"percentile":0.78608,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96652&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96652","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96652 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96652&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96652, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisa-cg","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96652","type":"primary","publishedAt":"2026-09-23T16:06:15.517Z","checkedAt":"2026-10-26T13:40:05.166Z","supports":"The published CVE-2026-96652 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:40:05.166Z","reviewedAt":null}},{"id":"CVE-2026-96654","cveId":"CVE-2026-96654","aliases":[],"kind":"vulnerability","title":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","summary":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":null,"regions":["Global"],"vendor":"Plex","product":"Media Server","stacks":["Plex Media Server","Plex","Media Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-10-23","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-96654","asOf":"2026-10-20T16:46:16.219Z"},"epss":{"probability":0.01949,"percentile":0.80085,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96654&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96654","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96654 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96654&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96654, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisa-cg","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96654","type":"primary","publishedAt":"2026-09-23T16:06:35.821Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-96654 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null}},{"id":"CVE-2026-96655","cveId":"CVE-2026-96655","aliases":[],"kind":"vulnerability","title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","summary":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":null,"regions":["Global"],"vendor":"Plex","product":"Media Server","stacks":["Plex Media Server","Plex","Media Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-11-03","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-96655","asOf":"2026-09-23T16:06:53.133Z"},"epss":{"probability":0.01637,"percentile":0.76162,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96655&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96655","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96655 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96655&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96655, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisa-cg","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96655","type":"primary","publishedAt":"2026-09-23T16:06:53.133Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-96655 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null}},{"id":"CVE-2026-96656","cveId":"CVE-2026-96656","aliases":[],"kind":"vulnerability","title":"Plex Media Server External Control of File Name or Path Vulnerability","summary":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","detail":"CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-20","updatedAt":null,"regions":["Global"],"vendor":"Plex","product":"Media Server","stacks":["Plex Media Server","Plex","Media Server"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-20","dueAt":"2026-10-23","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-96656","asOf":"2026-09-23T16:07:10.048Z"},"epss":{"probability":0.01785,"percentile":0.78146,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96656&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-96656","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-20","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-96656 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96656&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-96656, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA cisa-cg","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96656","type":"primary","publishedAt":"2026-09-23T16:07:10.048Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-96656 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null}},{"id":"CVE-2025-61624","cveId":"CVE-2025-61624","aliases":[],"kind":"vulnerability","title":"Fortinet Multiple Products Path Traversal Vulnerability","summary":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","detail":"CISA added this entry on 2026-10-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-16","updatedAt":null,"regions":["Global"],"vendor":"Fortinet","product":"Multiple Products","stacks":["Fortinet","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-16","dueAt":"2026-10-19","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2025-61624","asOf":"2026-04-14T15:39:51.445Z"},"epss":{"probability":0.01343,"percentile":0.71155,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-61624&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2025-61624","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-16","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2025-61624 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-61624&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2025-61624, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA fortinet","url":"https://cveawg.mitre.org/api/cve/CVE-2025-61624","type":"primary","publishedAt":"2026-04-14T15:39:51.445Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2025-61624 document's CNA supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null}},{"id":"CVE-2026-21589","cveId":"CVE-2026-21589","aliases":[],"kind":"vulnerability","title":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","summary":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.","detail":"CISA added this entry on 2026-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-15","updatedAt":null,"regions":["Global"],"vendor":"Atlassian","product":"Multiple Products","stacks":["Atlassian","Multiple Products"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-15","dueAt":"2026-10-18","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-21589","asOf":"2026-10-19T18:26:40.891Z"},"epss":{"probability":0.99477,"percentile":0.99943,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-21589&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2026-21589","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-15","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2026-21589 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21589&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2026-21589, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program CNA atlassian","url":"https://cveawg.mitre.org/api/cve/CVE-2026-21589","type":"primary","publishedAt":"2026-10-05T21:30:00.390Z","checkedAt":"2026-10-26T13:55:58.691Z","supports":"The published CVE-2026-21589 document's CNA supplies this CVSS 4.0 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T13:55:58.691Z","reviewedAt":null}},{"id":"CVE-2015-3306","cveId":"CVE-2015-3306","aliases":[],"kind":"vulnerability","title":"ProFTPD Improper Access Control Vulnerability","summary":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","detail":"CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-08","updatedAt":null,"regions":["Global"],"vendor":"ProFTPD","product":"ProFTPD","stacks":["ProFTPD"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-08","dueAt":"2026-10-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2015-3306","asOf":"2026-10-09T16:02:13.824Z"},"epss":{"probability":0.99497,"percentile":0.99944,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-3306&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-3306","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-3306 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-3306&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-3306, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2015-3306","type":"primary","publishedAt":"2015-05-18T15:00:00.000Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2015-3306 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null}},{"id":"CVE-2015-5477","cveId":"CVE-2015-5477","aliases":[],"kind":"vulnerability","title":"ISC BIND Data Processing Errors Vulnerability","summary":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.","detail":"CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-08","updatedAt":null,"regions":["Global"],"vendor":"ISC","product":"BIND","stacks":["ISC","BIND"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-08","dueAt":"2026-10-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2015-5477","asOf":"2026-10-09T03:55:29.574Z"},"epss":{"probability":0.99584,"percentile":0.99946,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2015-5477&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2015-5477","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2015-5477 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5477&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2015-5477, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2015-5477","type":"primary","publishedAt":"2015-07-29T14:00:00.000Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2015-5477 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null}},{"id":"CVE-2016-3081","cveId":"CVE-2016-3081","aliases":[],"kind":"vulnerability","title":"Apache Struts Command Injection Vulnerability","summary":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","detail":"CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-08","updatedAt":null,"regions":["Global"],"vendor":"Apache","product":"Struts","stacks":["Apache Struts","Apache","Struts"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-08","dueAt":"2026-10-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2016-3081","asOf":"2026-10-09T03:55:30.407Z"},"epss":{"probability":0.96525,"percentile":0.99881,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2016-3081&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2016-3081","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2016-3081 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3081&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2016-3081, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2016-3081","type":"primary","publishedAt":"2016-04-26T14:00:00.000Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2016-3081 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null}},{"id":"CVE-2021-3199","cveId":"CVE-2021-3199","aliases":[],"kind":"vulnerability","title":"ONLYOFFICE Docs Server Path Traversal Vulnerability","summary":"ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.","detail":"CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","publishedAt":"2026-10-08","updatedAt":null,"regions":["Global"],"vendor":"ONLYOFFICE","product":"Docs","stacks":["ONLYOFFICE","Docs"],"knownExploited":true,"zeroDay":null,"kev":{"addedAt":"2026-10-08","dueAt":"2026-10-11","action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomwareUse":"Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z"},"metrics":{"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2021-3199","asOf":"2026-10-09T03:55:31.111Z"},"epss":{"probability":0.30244,"percentile":0.98208,"date":"2026-10-25","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-3199&date=2026-10-25"}},"ai":{"role":"unknown","evidence":"not-assessed","explanation":"The source does not establish attacker AI use.","sourceUrl":null},"sources":[{"name":"CISA KEV entry CVE-2021-3199","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","type":"primary","publishedAt":"2026-10-08","checkedAt":"2026-10-26T18:50:55.505Z","supports":"The CVE-2021-3199 catalog entry establishes known exploitation, date added, required action, and the federal due date; not zero-day status."},{"name":"FIRST measured EPSS score","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-3199&date=2026-10-25","type":"primary","publishedAt":"2026-10-25","checkedAt":"2026-10-26T13:40:05.166Z","supports":"Measured EPSS probability and percentile for CVE-2021-3199, scored 2026-10-25. This is a model estimate, not proof of exposure."},{"name":"CVE Program ADP assessment CISA-ADP","url":"https://cveawg.mitre.org/api/cve/CVE-2021-3199","type":"primary","publishedAt":"2021-01-22T02:41:34.000Z","checkedAt":"2026-10-26T14:11:55.600Z","supports":"The published CVE-2021-3199 document's ADP assessment supplies this CVSS 3.1 base score, vector, and authoritative source update date."}],"provenance":{"origin":"pipeline","retrievedAt":"2026-10-26T14:11:55.600Z","reviewedAt":null}}],"pagination":{"total":8058,"offset":0,"limit":25,"hasMore":true},"sources":[{"id":"editorial","name":"Editorial Evidence Review","url":null,"feedUrl":null,"category":"editorial","status":"editorial","lastAttemptAt":null,"lastSuccessAt":null,"lastError":null,"recordCount":19,"scope":"Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends.","limitations":"A manually reviewed, dated editorial sample, not a live feed. Source claims and dates remain tied to each record; no invented scores or trends.","updateCadenceMinutes":null},{"id":"cisa-kev","name":"CISA Known Exploited Vulnerabilities","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","feedUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","category":"catalog","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.739Z","lastError":null,"recordCount":1756,"scope":"The full successfully validated KEV catalog, without a newest-record slice.","limitations":"Known exploitation is not necessarily a zero-day. KEV-only publication dates denote catalog additions, not initial disclosure. Due dates concern covered US federal agencies, not your SLA. The last complete catalog is retained for 30 days; oversized or incomplete replacements are rejected, not truncated.","updateCadenceMinutes":5,"freshnessWindowMinutes":15,"retentionDays":30,"maxRetainedRecords":25000,"optional":false,"partial":false,"processedCount":1756,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"catalogRecords":1756,"fullCatalog":true,"eligibleIncomingRecords":1756}},{"id":"github-advisories","name":"GitHub Public Security Advisories","url":"https://github.com/advisories","feedUrl":"https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc","category":"advisories","status":"cached","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:40:59.678Z","lastError":"Public source returned an error. (HTTP 403)","recordCount":308,"scope":"GitHub-reviewed public advisories, sorted by update date; at most 3 cursor pages of 100 records per cycle, without authentication.","limitations":"Not the entire advisory database. GitHub review is upstream review, not local editorial review or proof of remediation. Withdrawn advisories are excluded. Retained union is bounded to 2,000 records updated within 180 days; public API rate limits can reduce coverage.","updateCadenceMinutes":5,"freshnessWindowMinutes":15,"retentionDays":180,"maxRetainedRecords":2000,"optional":false,"partial":true,"processedCount":0,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"pagesFetched":3,"maxPages":3,"pageSize":100,"furtherPagesNotRequested":true,"eligibleIncomingRecords":283}},{"id":"jpcert","name":"JPCERT/CC Japan Advisories","url":"https://www.jpcert.or.jp/","feedUrl":"https://www.jpcert.or.jp/rss/jpcert.rdf","category":"advisories","status":"live","lastAttemptAt":"2026-10-26T18:40:55.462Z","lastSuccessAt":"2026-10-26T18:40:55.873Z","lastError":null,"recordCount":32,"scope":"Current Japanese-language alerts and weekly report entries, with the exact article or weekly-report anchor.","limitations":"RSS usually supplies only a Japanese title and date. Titles matching JPCERT/CC's fixed patterns are shown in English via a deterministic glossary translation with the original Japanese retained; unmatched titles stay in Japanese rather than being guessed. No affected-version detail is invented. Japan denotes this advisory audience, not a scan or proof of exposure. Up to 500 records are retained for 365 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":365,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":32,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":30,"excludedByTopic":0,"eligibleIncomingRecords":32}},{"id":"project-zero","name":"Google Project Zero Research","url":"https://projectzero.google/","feedUrl":"https://projectzero.google/feed.xml","category":"research","status":"live","lastAttemptAt":"2026-10-26T18:35:55.322Z","lastSuccessAt":"2026-10-26T18:35:57.768Z","lastError":null,"recordCount":10,"scope":"Security-research entries in the official Atom feed, including explicit AI-defense research when present; no archive crawling.","limitations":"The official feed is large but contains a bounded current entry list. Excerpts are not full articles. Ordinary fuzzing, automation, and exploit research are not classified as AI. Up to 250 records are retained for 730 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":730,"maxRetainedRecords":250,"optional":false,"partial":false,"processedCount":10,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":0,"eligibleIncomingRecords":10}},{"id":"google-security","name":"Google Security Research","url":"https://security.googleblog.com/","feedUrl":"https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50","category":"research","status":"live","lastAttemptAt":"2026-10-26T18:35:55.322Z","lastSuccessAt":"2026-10-26T18:35:57.804Z","lastError":null,"recordCount":47,"scope":"At most the 50 entries supplied by the official Google Security RSS endpoint; security-topic filtering and conservative, source-linked AI classifications.","limitations":"Not all Google research or all AI defense. Product security and prompt-injection research do not establish attacker AI use. Excerpts are not independently reproduced findings. Up to 250 records are retained for 730 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":730,"maxRetainedRecords":250,"optional":false,"partial":false,"processedCount":50,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":50,"excludedByTopic":0,"eligibleIncomingRecords":47}},{"id":"nvd-recent","name":"NVD Recently Published CVEs","url":"https://nvd.nist.gov/vuln/search","feedUrl":"https://services.nvd.nist.gov/rest/json/cves/2.0","category":"catalog","status":"live","lastAttemptAt":"2026-10-26T18:20:57.477Z","lastSuccessAt":"2026-10-26T18:21:53.012Z","lastError":null,"recordCount":5738,"scope":"Every CVE in the NVD, from any vendor worldwide, that any scorer (the vendor/CNA, NVD, or CISA) rates HIGH or CRITICAL, or that CISA's assessment reports as actively exploited. A 14-day backfill on first run, then every CVE modified since the last successful retrieval.","limitations":"Medium and low severity CVEs are not ingested; unscored CVEs appear once scored. The CNA (vendor) score is preferred over NVD's own when both exist. NVD publication is not evidence of exploitation. Up to 6,000 records are retained for 120 days.","updateCadenceMinutes":30,"freshnessWindowMinutes":60,"retentionDays":120,"maxRetainedRecords":6000,"optional":false,"partial":false,"processedCount":542,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"mode":"modified-since-last-success","windowStart":"2026-10-26T16:51:02.326Z","cvesInWindow":958,"pages":2,"keptHighOrCritical":542,"skippedBelowHighOrUnscored":416,"skippedWithdrawnByNvd":0,"eligibleIncomingRecords":542}},{"id":"breach-reporting","name":"BleepingComputer Security Reporting","url":"https://www.bleepingcomputer.com/","feedUrl":"https://www.bleepingcomputer.com/feed/","category":"reporting","status":"unavailable","lastAttemptAt":"2026-10-26T17:55:56.219Z","lastSuccessAt":null,"lastError":"Public source returned an error. (HTTP 403)","recordCount":0,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":5,"freshnessWindowMinutes":15,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":true,"processedCount":0,"rejectedCount":0,"nextRetryAt":"2026-10-26T19:55:57.312Z","cacheError":null,"coverage":{}},{"id":"thehackernews","name":"The Hacker News","url":"https://thehackernews.com/","feedUrl":"https://feeds.feedburner.com/TheHackersNews","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.718Z","lastError":null,"recordCount":30,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":5,"freshnessWindowMinutes":15,"retentionDays":90,"maxRetainedRecords":1000,"optional":false,"partial":false,"processedCount":30,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":50,"excludedByTopic":21,"eligibleIncomingRecords":28}},{"id":"securityweek","name":"SecurityWeek","url":"https://www.securityweek.com/","feedUrl":"https://www.securityweek.com/feed/","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.667Z","lastError":null,"recordCount":6,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":4,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":6,"eligibleIncomingRecords":4}},{"id":"helpnetsecurity","name":"Help Net Security","url":"https://www.helpnetsecurity.com/","feedUrl":"https://www.helpnetsecurity.com/feed/","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:45:56.766Z","lastSuccessAt":"2026-10-26T18:45:58.962Z","lastError":null,"recordCount":1,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":1,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":9,"eligibleIncomingRecords":1}},{"id":"therecord","name":"The Record (Recorded Future News)","url":"https://therecord.media/","feedUrl":"https://therecord.media/feed","category":"reporting","status":"cached","lastAttemptAt":"2026-10-26T16:50:55.493Z","lastSuccessAt":"2026-10-26T14:15:57.066Z","lastError":"Syndication returned no eligible validated records; HTTP success was not ingestion success.","recordCount":1,"scope":"Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":true,"processedCount":0,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":5,"excludedByTopic":4,"eligibleIncomingRecords":1}},{"id":"axios","name":"Axios","url":"https://www.axios.com/","feedUrl":"https://api.axios.com/feed/","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.667Z","lastError":null,"recordCount":3,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":3,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":100,"excludedByTopic":97,"eligibleIncomingRecords":3}},{"id":"techcrunch","name":"TechCrunch Security","url":"https://techcrunch.com/category/security/","feedUrl":"https://techcrunch.com/category/security/feed/","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.649Z","lastError":null,"recordCount":3,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":3,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":20,"excludedByTopic":17,"eligibleIncomingRecords":3}},{"id":"wired","name":"WIRED Security","url":"https://www.wired.com/category/security/","feedUrl":"https://www.wired.com/feed/category/security/latest/rss","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.667Z","lastError":null,"recordCount":5,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":5,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":20,"excludedByTopic":15,"eligibleIncomingRecords":5}},{"id":"theverge","name":"The Verge (AI)","url":"https://www.theverge.com/ai-artificial-intelligence","feedUrl":"https://www.theverge.com/rss/ai-artificial-intelligence/index.xml","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.667Z","lastError":null,"recordCount":0,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":0,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":10,"eligibleIncomingRecords":0}},{"id":"media404","name":"404 Media","url":"https://www.404media.co/","feedUrl":"https://www.404media.co/rss/","category":"news","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:55.718Z","lastError":null,"recordCount":0,"scope":"General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":0,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":15,"excludedByTopic":15,"eligibleIncomingRecords":0}},{"id":"hibp","name":"Have I Been Pwned","url":"https://haveibeenpwned.com/PwnedWebsites","feedUrl":"https://haveibeenpwned.com/api/v3/breaches","category":"catalog","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:57.041Z","lastError":null,"recordCount":121,"scope":"Breaches loaded into Have I Been Pwned in the last year: breached organization, account count, exposed data types, breach and load dates, and the organization's disclosure when HIBP links one.","limitations":"HIBP covers breaches whose data it obtained and loaded; many breaches never appear there. Counts are accounts in the loaded data, not necessarily people. Unverified breaches are labeled as such; fabricated, spam-list, retired, and sensitive breaches are skipped. Up to 400 records are retained for 365 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":365,"maxRetainedRecords":400,"optional":false,"partial":false,"processedCount":121,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"breachesInWindow":121,"skippedFabricatedSpamRetiredOrSensitive":926,"eligibleIncomingRecords":121}},{"id":"databreaches","name":"DataBreaches.net","url":"https://databreaches.net/","feedUrl":"https://databreaches.net/feed/","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:40:55.462Z","lastSuccessAt":"2026-10-26T18:40:55.873Z","lastError":null,"recordCount":5,"scope":"Breach and incident reporting selected from the current syndication feed, with exact article links.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":5,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":5,"eligibleIncomingRecords":5}},{"id":"hipaajournal","name":"The HIPAA Journal","url":"https://www.hipaajournal.com/","feedUrl":"https://www.hipaajournal.com/feed/","category":"reporting","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:57.095Z","lastError":null,"recordCount":7,"scope":"Healthcare breach and security reporting selected from the current feed; compliance guides and opinion are skipped.","limitations":"Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.","updateCadenceMinutes":30,"freshnessWindowMinutes":60,"retentionDays":90,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":7,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":3,"eligibleIncomingRecords":7}},{"id":"anthropic","name":"Anthropic","url":"https://www.anthropic.com/news","feedUrl":"https://www.anthropic.com/sitemap.xml","category":"ai-company","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:59.739Z","lastError":null,"recordCount":1,"scope":"Anthropic news posts about misuse, threats, safety, and security, found through its sitemap (it publishes no feed); at most 8 new pages are read per run.","limitations":"The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":730,"maxRetainedRecords":200,"optional":false,"partial":false,"processedCount":1,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"topicalPostsListed":8,"pagesReadThisRun":8,"excludedByTopic":7,"maxPagesPerRun":8,"eligibleIncomingRecords":1}},{"id":"openai","name":"OpenAI","url":"https://openai.com/news/","feedUrl":"https://openai.com/news/rss.xml","category":"ai-company","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:55.704Z","lastError":null,"recordCount":61,"scope":"OpenAI news posts about misuse, threats, safety, and security; product and business posts are skipped.","limitations":"The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.","updateCadenceMinutes":30,"freshnessWindowMinutes":60,"retentionDays":730,"maxRetainedRecords":200,"optional":false,"partial":false,"processedCount":85,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":1320,"excludedByTopic":1235,"eligibleIncomingRecords":61}},{"id":"deepmind","name":"Google DeepMind","url":"https://deepmind.google/blog/","feedUrl":"https://deepmind.google/blog/rss.xml","category":"ai-company","status":"live","lastAttemptAt":"2026-10-26T18:25:55.448Z","lastSuccessAt":"2026-10-26T18:25:55.704Z","lastError":null,"recordCount":1,"scope":"Google DeepMind blog posts about misuse, threats, safety, and security; product and research-only posts are skipped.","limitations":"The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":730,"maxRetainedRecords":200,"optional":false,"partial":false,"processedCount":1,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":100,"excludedByTopic":99,"eligibleIncomingRecords":1}},{"id":"microsoft-security","name":"Microsoft Security blog","url":"https://www.microsoft.com/en-us/security/blog/","feedUrl":"https://www.microsoft.com/en-us/security/blog/feed/","category":"ai-company","status":"live","lastAttemptAt":"2026-10-26T18:50:55.505Z","lastSuccessAt":"2026-10-26T18:50:59.031Z","lastError":"1 malformed upstream records were excluded.","recordCount":4,"scope":"Microsoft Threat Intelligence and security posts: vulnerabilities, threat actors, and AI misuse it observed.","limitations":"The publishing company's own reporting about threats it observed; not independently confirmed here. Marketing posts are skipped. Up to 300 records are retained for 365 days.","updateCadenceMinutes":30,"freshnessWindowMinutes":60,"retentionDays":365,"maxRetainedRecords":300,"optional":false,"partial":true,"processedCount":4,"rejectedCount":1,"nextRetryAt":"2026-10-26T18:55:59.031Z","cacheError":null,"coverage":{"feedEntries":10,"excludedByTopic":5,"eligibleIncomingRecords":4}},{"id":"aiid","name":"AI Incident Database","url":"https://incidentdatabase.ai/","feedUrl":"https://incidentdatabase.ai/rss.xml","category":"ai-incidents","status":"live","lastAttemptAt":"2026-10-26T18:45:56.766Z","lastSuccessAt":"2026-10-26T18:46:59.993Z","lastError":null,"recordCount":49,"scope":"Reports newly added to the AI Incident Database (Responsible AI Collaborative) that concern security or misuse (deepfakes, scams, influence operations, attacks on or by AI, unauthorized actions), each linking to the original report on its publisher's site. Vehicle crashes, lawsuits, bias, errors, and other non-security harms are skipped; non-English reports usually are too, because the filter reads English.","limitations":"Inclusion in the database means an editor judged it an AI incident; it is not an independent investigation. The linked report is the evidence. An AI role is assigned only when the report title states it. Up to 500 records are retained for 365 days.","updateCadenceMinutes":60,"freshnessWindowMinutes":120,"retentionDays":365,"maxRetainedRecords":500,"optional":false,"partial":false,"processedCount":49,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"feedEntries":100,"excludedByTopic":51,"eligibleIncomingRecords":49}},{"id":"first-epss","name":"FIRST EPSS","url":"https://www.first.org/epss/","feedUrl":"https://api.first.org/data/v1/epss","category":"enrichment","status":"live","lastAttemptAt":"2026-10-26T13:40:05.166Z","lastSuccessAt":"2026-10-26T13:40:30.430Z","lastError":null,"recordCount":6700,"scope":"Measured EPSS rows for real CVE identifiers already in this corpus; batches of at most 80 identifiers and under 1,900 CVE-query characters.","limitations":"Daily model scores estimate exploitation in the following 30 days, not organizational exposure. Missing CVEs receive no default score. Exact scoring dates and per-CVE/date API evidence are retained for 30 days; scores older than 2 days are stale even if a retrieval succeeds.","updateCadenceMinutes":360,"freshnessWindowMinutes":720,"retentionDays":30,"maxRetainedRecords":30000,"optional":false,"partial":false,"processedCount":6700,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"queriedCves":6798,"validatedScores":6700,"batches":85,"completedBatches":85,"unscoredCves":98,"eligibleIncomingRecords":6700},"scoresAsOf":"2026-10-25","oldestScoreDate":"2026-10-25","staleScoreCount":0,"scoreFreshnessDays":2},{"id":"cve-cna","name":"CVE Program CVSS Enrichment","url":"https://www.cve.org/","feedUrl":"https://cveawg.mitre.org/api/cve/","category":"enrichment","status":"live","lastAttemptAt":"2026-10-26T18:41:00.745Z","lastSuccessAt":"2026-10-26T18:41:03.388Z","lastError":"1 targeted CNA requests failed. Public source returned an error. (HTTP 404)","recordCount":140,"scope":"At most 8 published per-CVE documents per cycle, one request at a time, for missing CVSS or an editorial CVE-API measurement not yet rechecked; no NVD polling.","limitations":"Targeted enrichment, not full CVE coverage. CNA CVSS is preferred; if absent, an explicitly labeled public ADP assessment can supply the actual metric and authoritative source update date. A document with no usable CVSS is not a metric-ingestion success. Unscored targets are deferred for 24 hours. Up to 4,000 enrichments are retained for 30 days.","updateCadenceMinutes":15,"freshnessWindowMinutes":30,"retentionDays":30,"maxRetainedRecords":4000,"optional":true,"partial":true,"processedCount":7,"rejectedCount":0,"nextRetryAt":null,"cacheError":null,"coverage":{"targetedCves":8,"documentsChecked":7,"validatedCvss":7,"maxRequestsPerCycle":8,"eligibleIncomingRecords":7}}],"stats":{"totalRecords":8060,"knownExploited":1763,"aiRecords":132,"countsByKind":{"vulnerability":7717,"breach":138,"ai-research":33,"advisory":77,"ai-incident":95},"countsByRegion":{"Global":8029,"Japan":39},"aiRoles":{"unknown":7957,"infrastructure":13,"defense":26,"offense":56,"autonomous":8}},"trends":{"kevByMonth":[{"month":"2021-11","count":291},{"month":"2021-12","count":20},{"month":"2022-01","count":40},{"month":"2022-02","count":32},{"month":"2022-03","count":226},{"month":"2022-04","count":45},{"month":"2022-05","count":83},{"month":"2022-06","count":48},{"month":"2022-07","count":3},{"month":"2022-08","count":23},{"month":"2022-09","count":24},{"month":"2022-10","count":12},{"month":"2022-11","count":10},{"month":"2022-12","count":9},{"month":"2023-01","count":5},{"month":"2023-02","count":14},{"month":"2023-03","count":18},{"month":"2023-04","count":17},{"month":"2023-05","count":19},{"month":"2023-06","count":24},{"month":"2023-07","count":16},{"month":"2023-08","count":8},{"month":"2023-09","count":19},{"month":"2023-10","count":18},{"month":"2023-11","count":18},{"month":"2023-12","count":11},{"month":"2024-01","count":21},{"month":"2024-02","count":9},{"month":"2024-03","count":10},{"month":"2024-04","count":10},{"month":"2024-05","count":14},{"month":"2024-06","count":9},{"month":"2024-07","count":14},{"month":"2024-08","count":19},{"month":"2024-09","count":25},{"month":"2024-10","count":17},{"month":"2024-11","count":22},{"month":"2024-12","count":16},{"month":"2025-01","count":14},{"month":"2025-02","count":27},{"month":"2025-03","count":32},{"month":"2025-04","count":15},{"month":"2025-05","count":24},{"month":"2025-06","count":20},{"month":"2025-07","count":20},{"month":"2025-08","count":15},{"month":"2025-09","count":16},{"month":"2025-10","count":31},{"month":"2025-11","count":11},{"month":"2025-12","count":20},{"month":"2026-01","count":17},{"month":"2026-02","count":28},{"month":"2026-03","count":26},{"month":"2026-04","count":31},{"month":"2026-05","count":21},{"month":"2026-06","count":23},{"month":"2026-07","count":26},{"month":"2026-08","count":31},{"month":"2026-09","count":43},{"month":"2026-10","count":26}],"methodology":"Counts of records in the last complete validated CISA KEV catalog, grouped by each source dateAdded month (UTC calendar month). The denominator is the disclosed current catalog, not the editorial sample. This measures catalog additions represented in that snapshot, not worldwide attacks, discovery dates, zero-days, or causation by AI; removals can change historical counts.","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","asOf":"2026-10-23T19:30:18.920Z","corpus":{"name":"CISA KEV catalog","totalRecords":1756,"catalogVersion":"2026.10.23","earliestAddedAt":"2021-11-03","latestAddedAt":"2026-10-23"}},"generatedAt":"2026-10-26T18:55:20.497Z"}